Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 23
Reset filtersOpenZeppelin Contracts base64 encoding may read from potentially dirty memory
OpenZeppelin Contracts and Contracts Upgradeable duplicated execution of subcalls in v4.9.4
OpenZeppelin Contracts vulnerable to Improper Escaping of Output
OpenZeppelin Contracts using MerkleProof multiproofs may allow proving arbitrary leaves for specific trees
OpenZeppelin Contracts's governor proposal creation may be blocked by frontrunning
GovernorCompatibilityBravo may trim proposal calldata
OpenZeppelin Contracts TransparentUpgradeableProxy clashing selector calls may not be delegated
OpenZeppelin Contracts contains Incorrect Calculation
OpenZeppelin Contracts vulnerable to ECDSA signature malleability
OpenZeppelin Contracts's GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals
OpenZeppelin Contracts's Cross chain utilities for Arbitrum L2 see EOA calls as cross chain calls
OpenZeppelin Contracts ERC165Checker unbounded gas consumption
OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signers
OpenZeppelin Contracts's ERC165Checker may revert instead of returning false
Inconsistent storage layout for ERC2771ContextUpgradeable
GovernorCompatibilityBravo incorrect ABI encoding may lead to unexpected behavior
OpenZeppelin Contracts initializer reentrancy may lead to double initialization
ERC1155Supply vulnerability in OpenZeppelin Contracts
UUPSUpgradeable vulnerability in @openzeppelin/contracts
UUPSUpgradeable vulnerability in @openzeppelin/contracts-upgradeable
TimelockController vulnerability in OpenZeppelin Contracts
TimelockController vulnerability in OpenZeppelin Contracts
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.